7ec44915c66da5106e491b5058827b07993eb63e98ae62276abfe87e717bae0b

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

12526447ebca4a41e47e5a50192a6d0c_JaffaCakes118.html
Size

18KB
MD5

12526447ebca4a41e47e5a50192a6d0c
SHA1

fd5fb22df6d1554ffdfe545bd7968f999b8c5274
SHA256

7ec44915c66da5106e491b5058827b07993eb63e98ae62276abfe87e717bae0b
SHA512

32d634e8efb64454242cdd4e3343d0ede527816be49b22edbd3590db37af5f704494b786f309b56e17468ab036b0a99f356f76cb07cee6ac54e44f140eb9ee98
SSDEEP

384:3OkBSmyueYgq90z3hHAjzQW0/exLiqwHk3wIiq6p:rBSmyueYgq90z3hHOz02JiTk3wIiqw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2616	msedge.exe
2616	msedge.exe
3320	identity_helper.exe
3320	identity_helper.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 4340	2616	msedge.exe	83
PID 2616 wrote to memory of 4340	2616	msedge.exe	83
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 4064	2616	msedge.exe	84
PID 2616 wrote to memory of 2340	2616	msedge.exe	85
PID 2616 wrote to memory of 2340	2616	msedge.exe	85
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86
PID 2616 wrote to memory of 524	2616	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\12526447ebca4a41e47e5a50192a6d0c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7e6746f8,0x7ffd7e674708,0x7ffd7e674718
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,1205041698844588261,11787074406431188233,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,1205041698844588261,11787074406431188233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,1205041698844588261,11787074406431188233,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1205041698844588261,11787074406431188233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1205041698844588261,11787074406431188233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,1205041698844588261,11787074406431188233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,1205041698844588261,11787074406431188233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1205041698844588261,11787074406431188233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1205041698844588261,11787074406431188233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1205041698844588261,11787074406431188233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1205041698844588261,11787074406431188233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,1205041698844588261,11787074406431188233,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2652 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
378B

MD5
49d9ed5a7f0cd7faf95c5602f56d2351

SHA1
3b7e2e0c2b9da1a71e3d30c554865ffbf98b105b

SHA256
a0eaf16f7203bcf94151150bab661b003da359de2db46f9995fb26f0e494d966

SHA512
9e938a7eda6af899686b2f3411b727f24b797ceddb951d4a3d5f10c8ef5b9d24c4901cfe93d652bf02f63b21da6ee19482bfde8fd197d5495b96e40dd41c8d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88731fe0cdd67bd894cd9e1fb5be716a

SHA1
54310ec8c23348be655862ad59e3a843dc437d81

SHA256
2cdc3518c71c9763193a6009bae7fdff6dbac26ea5249db4d45cefeaebb25c73

SHA512
d31b8f4f188a76e6e00af1f6ebd6befc50d9d29a096297145e5731e7f4c2244e138e3001c92c8e13d0e3fb1a6c7457298e50c675a580f28cb0b9aa1068897d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04c8b15cd6370723ba1f9ca7888c6dae

SHA1
7c33d6d282a6964fa83199bb649095a3ff496c2e

SHA256
eb2a50f8e3abf8aef71735e16794205392612623bf3e15445c24bd351efd0b8c

SHA512
986e9ae6034174a03cfd712c94ebe2247e5bb6c113c45042a14796a30ac21fe52454e86d777031ff7d6a5e42b3c3ee510cb42455ae0c2348b797c3df8d59917f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
8f3f9fcc29594535c364eb274dfa7a61

SHA1
fd31352685163235ad17656d860ba927564515de

SHA256
200e6da8c248ac85a3463c2361eb554eac2191405a67b69417e658c6c2b6187d

SHA512
7abebe2e45e2edc3ac0abbfe984ac44aa890464815270a8a4b4ed9bbf54c716d3276d38a4b718c691c3938a65611d818c22e6700a6267b01766dea43d1c8445a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b6dc.TMP

Filesize
372B

MD5
ca4f27d26c5b5d34b48af9e4e5673226

SHA1
d5fe3552cf042441e9cfec900b8c54fa997f1a91

SHA256
b41908cdc8b5908c92ff35e0384dbfa97b451d6b91bfa317e4b3055c1d920916

SHA512
d39d0fc4784412f916df1ad59aa909a44cdb3a9cc6a48b3157d9403e7624ca2eb4f492e7ae1ea18007f388d444093440602fbb048d1a57e84fe0832b6158cea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b3aaae3e4e81528b1143284b79e2f03b

SHA1
b77866fce0ca820278d6c025094fbfe240571b03

SHA256
f219857297dfc75f4078ef0786fb105912f022276db881d00bf11e8298d14ee4

SHA512
d9988bd48c279807526cbd155ef1fd35ad8578230168764e1178a0d78fd9ebb3acbd976c467e2273852f81166b27e492c068f7c066aa2ad0cfbaa8cd7cbd8be7

Download Submit